@simple-auth-kit/cli 1.5.1 → 1.6.1

package/registry/combos/nestjs-drizzle/variants/base/src/seed.ts

@@ -24,14 +24,23 @@ import { eq, inArray, notInArray } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import type { Database } from "./db.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, SEED_ADMIN_ROLES, SEED_SUPERADMIN_ROLES, provisionDefaultRoles } from "./rbac.defaults.js";
+import type { Database } from "./config/db.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  SEED_ADMIN_ROLES,
+  SEED_SUPERADMIN_ROLES,
+  provisionDefaultRoles,
+} from "./rbac.defaults.js";
 import * as schema from "./schema.js";
 import { permissions, roleUser, roles, users } from "./schema.js";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
@@ -39,7 +48,10 @@ function requireEnv(name: string): string {
 async function seedRbacDefaults(db: Database): Promise<void> {
   await provisionDefaultRoles(db);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`,
+    );
 
   // Slugs that exist in the database but not in this build's catalog. They are not an error —
   // `POST /auth/admin/permissions` exists so a deployment can define its own, and a grant can
@@ -49,9 +61,18 @@ async function seedRbacDefaults(db: Database): Promise<void> {
     .select({ slug: permissions.slug })
     .from(permissions)
     .where(notInArray(permissions.slug, PERMISSION_SLUGS));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
-  const inactive = await db.select({ slug: permissions.slug }).from(permissions).where(eq(permissions.isActive, false));
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
+  const inactive = await db
+    .select({ slug: permissions.slug })
+    .from(permissions)
+    .where(eq(permissions.isActive, false));
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
 /** Roles are global here, so administrative authority is a property of the user row itself. */
@@ -59,15 +80,32 @@ async function seedAdminUser(db: Database): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
   // Hashed by the same function signup uses, so the seeded admin can actually log in.
-  const user = existing ?? (await db.insert(users).values({ email, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
   const adminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
@@ -87,16 +125,33 @@ async function seedSuperAdminUser(db: Database): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
   // Hashed by the same function signup uses, so the seeded super admin can actually log in.
-  const user = existing ?? (await db.insert(users).values({ email, username, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, username, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
   const superAdminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
@@ -105,10 +160,14 @@ async function seedSuperAdminUser(db: Database): Promise<void> {
   if (superAdminRoles.length) {
     await db
       .insert(roleUser)
-      .values(superAdminRoles.map((role) => ({ userId: user.id, roleId: role.id })))
+      .values(
+        superAdminRoles.map((role) => ({ userId: user.id, roleId: role.id })),
+      )
       .onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
   }
-  console.log(`super admin: holds roles ${superAdminRoles.map((r) => r.slug).join(", ")}`);
+  console.log(
+    `super admin: holds roles ${superAdminRoles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {

package/registry/combos/nestjs-drizzle/variants/base/src/services/auth.service.ts

@@ -52,19 +52,19 @@ import {
   generateTotpSecret,
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 import {
   AuditLogEntry,
   AuditLogListFilter,
   AuditLogRepository,
   toAuditLogEntry,
 } from "../repositories/audit-log.repository.js";
-import type { Paginated } from "../pagination.js";
-import { DRIZZLE_DB, type Database } from "../db.js";
-import { KeyProviderService } from "../key-provider.js";
+import type { Paginated } from "../helpers/pagination.js";
+import { DRIZZLE_DB, type Database } from "../config/db.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
-import { RATE_LIMIT_STORE } from "../rate-limit.store.js";
+import { RATE_LIMIT_STORE } from "../cache/rate-limit.store.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
 import {
   PermissionInput,
@@ -79,7 +79,7 @@ import {
 import { sessions, users } from "../schema.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -490,9 +490,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;

package/registry/combos/nestjs-drizzle/variants/base/test/variant-hooks.ts

@@ -7,14 +7,24 @@ import "dotenv/config";
 import { eq, inArray } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
-import type { Database } from "../src/db.js";
-import { toId } from "../src/id.helper.js";
-import { POLICY_VERSION_KEY } from "../src/permission-cache.js";
-import { provisionDefaultRoles, SEED_ADMIN_ROLES } from "../src/rbac.defaults.js";
+import type { Database } from "../src/config/db.js";
+import { toId } from "../src/helpers/id.helper.js";
+import { POLICY_VERSION_KEY } from "../src/cache/permission-cache.js";
+import {
+  provisionDefaultRoles,
+  SEED_ADMIN_ROLES,
+} from "../src/rbac.defaults.js";
 import * as schema from "../src/schema.js";
 import { permissions, roleUser, roles } from "../src/schema.js";
 import { permissionCacheStore } from "./bootstrap.js";
-import { renewingToken, type AdminSession, type AuthTokens, type Principal, type ProofContext, type VariantHooks } from "./harness.js";
+import {
+  renewingToken,
+  type AdminSession,
+  type AuthTokens,
+  type Principal,
+  type ProofContext,
+  type VariantHooks,
+} from "./harness.js";
 
 /** One short-lived pool per call, closed on the way out, so the proof process has no lingering handle to wait on. */
 async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
@@ -32,7 +42,10 @@ let adminCredentials: { identifier: string; password: string } | undefined;
 export const hooks: VariantHooks = {
   variant: "base",
 
-  async makeAdmin(ctx: ProofContext, principal: Principal): Promise<AdminSession> {
+  async makeAdmin(
+    ctx: ProofContext,
+    principal: Principal,
+  ): Promise<AdminSession> {
     // The role slug on its own confers nothing — no guard checks for the string "admin". Authority
     // comes from the permission_role rows behind it, and in this variant the seeder is the only
     // thing that writes them, so the hook does what `npm run seed` does: calls the same
@@ -46,24 +59,36 @@ export const hooks: VariantHooks = {
         .where(inArray(roles.slug, SEED_ADMIN_ROLES));
       await db
         .insert(roleUser)
-        .values(adminRoles.map((role) => ({ userId: toId(principal.userId), roleId: role.id })))
+        .values(
+          adminRoles.map((role) => ({
+            userId: toId(principal.userId),
+            roleId: role.id,
+          })),
+        )
         .onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
     });
 
-    adminCredentials = { identifier: principal.email, password: principal.password };
+    adminCredentials = {
+      identifier: principal.email,
+      password: principal.password,
+    };
     // Those writes went straight to the database, behind the running app's back, so nothing
     // bumped a version counter and the caller's already-cached (empty) permissions would still be
     // served. Bumping the policy counter is exactly what an out-of-band writer is supposed to do —
     // see permission-cache.ts. Logging in would not have helped: nothing about authorization is
     // in the token.
     await permissionCacheStore.bump(POLICY_VERSION_KEY);
-    const login = await ctx.call("POST", "/auth/login", { body: { identifier: principal.email, password: principal.password } });
+    const login = await ctx.call("POST", "/auth/login", {
+      body: { identifier: principal.email, password: principal.password },
+    });
     const token = (login.body as AuthTokens).accessToken;
     ctx.assert(!!token, `the seeded admin can log in (got ${login.status})`);
     return {
       token,
       freshToken: renewingToken(async () => {
-        const res = await ctx.call("POST", "/auth/login", { body: adminCredentials! });
+        const res = await ctx.call("POST", "/auth/login", {
+          body: adminCredentials!,
+        });
         return (res.body as AuthTokens).accessToken;
       }),
     };
@@ -73,16 +98,37 @@ export const hooks: VariantHooks = {
     // Nothing to do: admin endpoints operate on the whole deployment.
   },
 
-  async proveVariantProperties(ctx: ProofContext, admin: AdminSession): Promise<void> {
-    const listed = await ctx.call("GET", "/auth/admin/users", { token: await admin.freshToken() });
-    ctx.assert(listed.status === 200, `admin can list every user in the deployment (got ${listed.status})`);
-    ctx.assert(Array.isArray(listed.body?.items) && listed.body.items.length > 0, "the user list is non-empty");
+  async proveVariantProperties(
+    ctx: ProofContext,
+    admin: AdminSession,
+  ): Promise<void> {
+    const listed = await ctx.call("GET", "/auth/admin/users", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      listed.status === 200,
+      `admin can list every user in the deployment (got ${listed.status})`,
+    );
+    ctx.assert(
+      Array.isArray(listed.body?.items) && listed.body.items.length > 0,
+      "the user list is non-empty",
+    );
 
-    const workspaces = await ctx.call("GET", "/workspaces", { token: await admin.freshToken() });
-    ctx.assert(workspaces.status === 404, `no workspace endpoints exist in this variant (got ${workspaces.status})`);
+    const workspaces = await ctx.call("GET", "/workspaces", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      workspaces.status === 404,
+      `no workspace endpoints exist in this variant (got ${workspaces.status})`,
+    );
 
-    const me = await ctx.call("GET", "/auth/me", { token: await admin.freshToken() });
-    ctx.assert(me.body?.roles?.includes("admin"), "roles are global: they apply to every request this user makes");
+    const me = await ctx.call("GET", "/auth/me", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      me.body?.roles?.includes("admin"),
+      "roles are global: they apply to every request this user makes",
+    );
 
     // --- authorization is not in the token, so a change lands on the next *request* ---
     //
@@ -96,24 +142,55 @@ export const hooks: VariantHooks = {
     const email = ctx.uniqueEmail("immediate");
     const password = "immediate-pw-12345";
     const tokens = await ctx.signup(email, password);
-    const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
-
-    const beforeGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(beforeGrant.status === 403, `a user with no grant is refused (got ${beforeGrant.status})`);
+    const userId = (
+      await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+    ).body.sub as string;
 
-    const granted = await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "users:read" } });
-    ctx.assert(granted.status === 200 || granted.status === 201, `admin can grant a permission directly (got ${granted.status})`);
+    const beforeGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      beforeGrant.status === 403,
+      `a user with no grant is refused (got ${beforeGrant.status})`,
+    );
 
-    const afterGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterGrant.status === 200, `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`);
+    const granted = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions`,
+      { token: await admin.freshToken(), body: { permission: "users:read" } },
+    );
+    ctx.assert(
+      granted.status === 200 || granted.status === 201,
+      `admin can grant a permission directly (got ${granted.status})`,
+    );
 
-    const revoked = await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`, {
-      token: await admin.freshToken(),
+    const afterGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
     });
-    ctx.assert(revoked.status === 200 || revoked.status === 201, `admin can revoke the direct grant (got ${revoked.status})`);
+    ctx.assert(
+      afterGrant.status === 200,
+      `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`,
+    );
 
-    const afterRevoke = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterRevoke.status === 403, `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`);
+    const revoked = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`,
+      {
+        token: await admin.freshToken(),
+      },
+    );
+    ctx.assert(
+      revoked.status === 200 || revoked.status === 201,
+      `admin can revoke the direct grant (got ${revoked.status})`,
+    );
+
+    const afterRevoke = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      afterRevoke.status === 403,
+      `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`,
+    );
 
     await proveTheCacheIsReal(ctx, admin, tokens.accessToken);
     await proveARawDatabaseEditChangesEnforcement(ctx, admin);
@@ -125,7 +202,11 @@ export const hooks: VariantHooks = {
  * app resolves through (`test/bootstrap.ts` hands it to `AuthModule.forRoot`), so "the second
  * request did not touch the database" is a measurement rather than a claim.
  */
-async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token: string): Promise<void> {
+async function proveTheCacheIsReal(
+  ctx: ProofContext,
+  admin: AdminSession,
+  token: string,
+): Promise<void> {
   const N = 8;
   await ctx.call("GET", "/auth/me", { token }); // warm, so the measurement is of the steady state
   const before = { ...permissionCacheStore.stats };
@@ -137,16 +218,27 @@ async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token
     `${N} identical authorized requests resolve permissions 0 further times — all ${N} were cache hits (misses +${after.misses - before.misses}, hits +${after.hits - before.hits})`,
   );
 
-  const userId = (await ctx.call("GET", "/auth/me", { token })).body.sub as string;
+  const userId = (await ctx.call("GET", "/auth/me", { token })).body
+    .sub as string;
   const beforeGrant = { ...permissionCacheStore.stats };
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "probe:cache" } });
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "probe:cache" },
+  });
   const afterGrantCall = await ctx.call("GET", "/auth/me", { token });
   ctx.assert(
     permissionCacheStore.stats.misses > beforeGrant.misses,
     "a grant bumps this user's version counter, so the next request misses the cache and re-resolves rather than serving a stale entry",
   );
-  ctx.assert((afterGrantCall.body?.permissions ?? []).includes("probe:cache"), "…and the freshly resolved answer contains the new permission");
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`, { token: await admin.freshToken() });
+  ctx.assert(
+    (afterGrantCall.body?.permissions ?? []).includes("probe:cache"),
+    "…and the freshly resolved answer contains the new permission",
+  );
+  await ctx.call(
+    "POST",
+    `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`,
+    { token: await admin.freshToken() },
+  );
 }
 
 /**
@@ -154,26 +246,56 @@ async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token
  * doing the writing — this rules out any possibility that it is also doing something in memory.
  * A `psql` session would look exactly like this.
  */
-async function proveARawDatabaseEditChangesEnforcement(ctx: ProofContext, admin: AdminSession): Promise<void> {
+async function proveARawDatabaseEditChangesEnforcement(
+  ctx: ProofContext,
+  admin: AdminSession,
+): Promise<void> {
   const email = ctx.uniqueEmail("rawedit");
   const tokens = await ctx.signup(email, "rawedit-pw-12345");
-  const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "audit-log:read" } });
-  ctx.assert((await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken })).status === 200, "a direct grant opens the audit log");
+  const userId = (
+    await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+  ).body.sub as string;
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "audit-log:read" },
+  });
+  ctx.assert(
+    (
+      await ctx.call("GET", "/auth/admin/audit-log", {
+        token: tokens.accessToken,
+      })
+    ).status === 200,
+    "a direct grant opens the audit log",
+  );
 
   const setActive = async (isActive: boolean) => {
     // Written straight to the table, with no code change and no redeploy. The bump that follows is
     // the out-of-band writer's half of the cache contract (permission-cache.ts) — without it the
     // edit would still land, but only once the cached entry expired.
-    await withDb((db) => db.update(permissions).set({ isActive }).where(eq(permissions.slug, "audit-log:read")));
+    await withDb((db) =>
+      db
+        .update(permissions)
+        .set({ isActive })
+        .where(eq(permissions.slug, "audit-log:read")),
+    );
     await permissionCacheStore.bump(POLICY_VERSION_KEY);
   };
 
   await setActive(false);
-  const denied = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(denied.status === 403, `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`);
+  const denied = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    denied.status === 403,
+    `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`,
+  );
 
   await setActive(true);
-  const restored = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(restored.status === 200, `…and reactivating it in the database opens the route again (got ${restored.status})`);
+  const restored = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    restored.status === 200,
+    `…and reactivating it in the database opens the route again (got ${restored.status})`,
+  );
 }

package/registry/combos/nestjs-drizzle/variants/workspaces/src/auth.module.ts

@@ -2,28 +2,32 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_INTERCEPTOR } from "@nestjs/core";
-import { AbilityGuard } from "./guards/ability.guard.js";
+import { AbilityGuard } from "./ability/ability.guard.js";
 import { AdminController } from "./controllers/admin.controller.js";
 import { AuditLogRepository } from "./repositories/audit-log.repository.js";
 import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
-import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
+import {
+  AUTH_CONFIG,
+  AuthConfig,
+  defaultAuthConfig,
+} from "./config/auth.config.js";
 import { AuthController } from "./controllers/auth.controller.js";
 import { AuthGuard } from "./guards/auth.guard.js";
 import { AuthService } from "./services/auth.service.js";
 import { AuthzGuard, WorkspaceGuard } from "./guards/authz.guard.js";
-import { DRIZZLE_DB } from "./db.js";
-import { KeyProviderService } from "./key-provider.js";
+import { DRIZZLE_DB } from "./config/db.js";
+import { KeyProviderService } from "./config/key-provider.js";
 import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
 import {
   InMemoryPermissionCacheStore,
   PERMISSION_CACHE_STORE,
   PermissionCache,
-} from "./permission-cache.js";
+} from "./cache/permission-cache.js";
 import {
   InMemoryRateLimitStore,
   RATE_LIMIT_STORE,
-} from "./rate-limit.store.js";
+} from "./cache/rate-limit.store.js";
 import { RbacRepository } from "./repositories/rbac.repository.js";
 import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";

package/registry/combos/nestjs-drizzle/variants/workspaces/src/controllers/admin.controller.ts

@@ -25,7 +25,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-drizzle/variants/workspaces/src/controllers/workspace.controller.ts

@@ -22,7 +22,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";
 import { Authenticated, CheckAbility } from "../route-tiers.js";

package/registry/combos/nestjs-drizzle/variants/workspaces/src/guards/authz.guard.ts

@@ -5,8 +5,8 @@ import {
   Inject,
   Injectable,
 } from "@nestjs/common";
-import { defineAbilitiesFor } from "../ability.js";
-import { PermissionCache } from "../permission-cache.js";
+import { defineAbilitiesFor } from "../ability/ability.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import {
   memberCacheKey,
   RbacRepository,

package/registry/combos/nestjs-drizzle/variants/workspaces/src/index.ts

@@ -0,0 +1,9 @@
+export * from "./auth.module.js";
+
+export * from "./route-tiers.js";
+
+export * from "./guards/auth.guard.js";
+export * from "./guards/authz.guard.js";
+
+export * from "./ability/ability.js";
+export * from "./ability/ability.guard.js";